danvics/rdt-client
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed vulnerability issue where the auth Update endpoint wasn't protected.

Browse source
This commit is contained in:
Roger Far 2025-03-07 12:29:33 -07:00
parent 5c987a9057
commit 794eec8666
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
server/RdtClient.Web/Controllers/AuthController.cs
View file

@ -82,6 +82,13 @@ public class AuthController(Authentication authentication, Settings settings) :
return StatusCode(401); return StatusCode(401);
} }
var user = await authentication.GetUser();
if (user != null)
{
return StatusCode(401);
}
await settings.Update("Provider:Provider", request.Provider); await settings.Update("Provider:Provider", request.Provider);
await settings.Update("Provider:ApiKey", request.Token); await settings.Update("Provider:ApiKey", request.Token);
@ -130,6 +137,7 @@ public class AuthController(Authentication authentication, Settings settings) :
[Route("Update")] [Route("Update")]
[HttpPost] [HttpPost]
[Authorize(Policy = "AuthSetting")]
public async Task<ActionResult> Update([FromBody] AuthControllerUpdateRequest? request) public async Task<ActionResult> Update([FromBody] AuthControllerUpdateRequest? request)
{ {
if (request == null) if (request == null)